feat: implement issue #1479 — Compliance: ruleset-drift-pr-quality-require_last_push_approval

[don-petry]

User description

Closes #1479

Implemented by dev-lead agent. Please review.

---

CodeAnt-AI Description

Document that PR approval compliance is already satisfied

What Changed

• Records that the live pr-quality ruleset already requires approval from the latest push
• Explains that the reported drift is stale and does not require a repository file change
• Documents the central ruleset ownership and the recommended no-op verification path

Impact

✅ PR approval gate remains enforced
✅ Clearer handling of stale compliance findings
✅ Avoids duplicate repository ruleset configuration

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

• Documentation
  • Added a compliance report confirming that the required last-push approval setting is active.
  • Documented verification details, review-integrity context, recommended remediation status, and supporting references.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	66b6a73	Aug 18, 2026 · 23:21	23:21

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8f07b2c9-9771-4c8f-b993-e3218cb0bbba

📥 Commits

Reviewing files that changed from the base of the PR and between 40f6c23 and cc57d86.

📒 Files selected for processing (1)

• docs/compliance/1479-pr-quality-require-last-push-approval.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The PR adds a compliance report for the centrally managed pr-quality ruleset. It records live verification that require_last_push_approval is true, explains the management boundary, recommends closing the stale finding, and adds supporting references.

Changes

Ruleset compliance documentation

Layer / File(s)	Summary
Compliance finding and live-state verification docs/compliance/1479-pr-quality-require-last-push-approval.md	Documents the expected and observed ruleset values, central ownership, authenticated live-state verification, approval-gate posture, remediation recommendation, and supporting references.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: 🔵 Low · up to cc57d

This PR adds a compliance record without changing enforcement, but the document still contains ambiguous repository wording, a noncanonical automation identity spelling, and non-neutral author attribution. It is mergeable with owner follow-up to correct these bounded documentation issues.

Possibly related issues

• petry-projects/ContentTwin issue 400: Covers the same pr-quality.require_last_push_approval compliance state and remediation.
• petry-projects/incubator issue 100: Covers the same ruleset setting and its current true state.
• petry-projects/broodly issue 409: Documents remediation of the same ruleset drift.

Possibly related PRs

• petry-projects/.github-private#1013: Covers migration and management of the same pr-quality ruleset setting.

Suggested labels: dev-lead:hands-off

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the change, but it omits the required template sections and checklist confirmations.	Use the repository template and complete the Summary, Interaction contract N/A checkbox, and Checklist sections.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the compliance issue and the specific ruleset parameter addressed.
Linked Issues check	✅ Passed	The documentation addresses issue #1479 by recording that the live ruleset already enforces the required setting.
Out of Scope Changes check	✅ Passed	The only change is compliance documentation directly related to issue #1479; no unrelated code changes are shown.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-1479-20260818-2315

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request adds a compliance verification document (docs/compliance/1479-pr-quality-require-last-push-approval.md) explaining that the reported drift in the pr-quality ruleset is already remediated and managed org-wide. The feedback suggests fixing the capitalization of automation-Integration and replacing the specific runtime reference dev-lead with a generic placeholder <id> to align with documentation standards.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #1533
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-08-18T23:54:12Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-08-18T23:54:12Z

[donpetry-bot]

Superseded by automated re-review at 66b6a73aa2bef7c60c916c969a14e9ffb9065f7b — click to expand prior review.

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: LOW
Reviewed commit: 66b6a73aa2bef7c60c916c969a14e9ffb9065f7b
Review mode: triage-approved (single reviewer)

Summary

Docs-only PR adding a compliance-verification document for issue #1479 (ruleset-drift-pr-quality-require_last_push_approval). The document's central claim was independently re-verified during this review: the live pr-quality ruleset (id 16142042) currently has require_last_push_approval: true with enforcement active, so the audit finding is stale and no in-repo change applies. The triage tier's low-risk assessment is confirmed. The only blocker is a single unresolved review thread (a minor bot nit), which also blocks merge via the ruleset's required_review_thread_resolution.

Linked issue analysis

Issue #1479 reports ruleset drift (require_last_push_approval expected true, actual false) with remediation via scripts/apply-rulesets.sh in the public petry-projects/.github repo. The PR substantively addresses it: live-state verification (re-confirmed by this review via gh api repos/petry-projects/.github-private/rulesets/16142042) shows the parameter is already at the codified value, and the doc correctly explains why no repo file change applies (the org-wide ruleset is centrally owned; this repo only commits repo-specific rulesets). Both referenced files (docs/initiatives/auto-rebase-approval-survival-spike.md, .github/rulesets/release-channel-tags.json) exist on main. Recommendation to close #1479 as already remediated is sound.

Findings

1. [BLOCKING — process, not content] One unresolved review thread from gemini-code-assist on docs/compliance/1479-pr-quality-require-last-push-approval.md: lowercase 'automation-Integration' → 'automation-integration' and use a generic placeholder instead of 'dev-lead'. Trivial nit, but the pr-quality ruleset enforces required_review_thread_resolution, so the PR cannot merge until this thread is addressed (apply the one-line suggestion or dismiss with rationale) and resolved.
2. No security issues: no secrets, no executable code, no workflow changes. The embedded gh api output contains no credentials. Secret-scanning MCP tool was not available in this run (noted per protocol); the gitleaks CI check passed.
3. Content accuracy spot-checked and correct (live ruleset value, file references, review-integrity rationale consistent with the auto-rebase approval-survival spike).

CI status

All quality checks green: Lint, ShellCheck, Agent Security Scan, Secret scan (gitleaks), Compile agentic workflows, CodeQL (actions+python), unit-tests, duplicate-decl-gate, Test-Deletion Guard (latest run), SonarCloud quality gate, AgentShield, holdout-guard. CANCELLED entries in the rollup are superseded or rate-limited Dev-Lead Agent orchestration jobs (dispatch succeeded on a later run at 23:24:23Z), not code-quality gates. mergeStateStatus=BLOCKED due to REVIEW_REQUIRED and the unresolved thread.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[donpetry-bot]

Superseded by automated re-review at cc57d86d201c76a1537ee9478d2014cad9346765 — click to expand prior review.

Review — fix requested (cycle 2/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: LOW
Reviewed commit: 66b6a73aa2bef7c60c916c969a14e9ffb9065f7b
Review mode: triage-approved (single reviewer)

Summary

Docs-only PR (+90, 1 file) adding a compliance-verification document for issue #1479. It records that the reported ruleset drift (pr-quality / require_last_push_approval expected true, actual false) is stale: the live ruleset already carries the codified value. I independently re-verified the live ruleset (id 16142042) during this review and confirmed require_last_push_approval: true with enforcement: active — the document's central claim is accurate. The triage tier's low-risk assessment is confirmed. The only blocker is an unresolved review thread from gemini-code-assist (a low-priority nit: automation-Integration capitalization and using a generic placeholder instead of dev-lead in a path reference). The repo's pr-quality ruleset enforces required_review_thread_resolution, so this thread must be resolved before merge regardless of my verdict.

Linked issue analysis

Closes #1479 (ruleset-drift-pr-quality-require_last_push_approval, severity error). The issue's remediation path is running apply-rulesets.sh from the public .github repo — an org-admin action, not an in-repo file change. The PR correctly explains that this repo intentionally does not carry a local copy of the org-wide ruleset (single source of truth lives in petry-projects/.github), and documents live-state verification showing the drift is already remediated. Independent re-check during this review confirms the live value matches the standard. Substantively addressed; closing #1479 on merge is appropriate.

Findings

1. [Blocking — process] Unresolved review thread. gemini-code-assist left a low-priority suggestion (capitalization of automation-Integration → automation-integration; use a generic placeholder rather than the runtime persona dev-lead). The thread is unresolved and not outdated. Gate: no unresolved review threads — and the live ruleset requires thread resolution to merge. Resolve (apply or dismiss with a reply) to unblock.
2. [Info] Secret scan: run_secret_scanning MCP tool not available in this environment; gitleaks CI check passed, and the diff is pure markdown with no credential material.
3. No security, correctness, or maintainability issues found in the document itself; internal relative links (release-channel-tags.json, auto-rebase spike doc) reference existing in-repo paths.

CI status

All required checks green: Lint, ShellCheck, unit-tests, CodeQL (actions + python), Agent Security Scan, agent-shield, Secret scan (gitleaks), SonarCloud, CodeRabbit, Graphite AI Reviews, holdout-guard, duplicate-decl-gate — all SUCCESS. A few CANCELLED entries (dev-lead / dispatch, guard, ci-relay) are superseded duplicate runs with successful reruns; no failures. mergeStateStatus: BLOCKED solely on review requirements.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[don-petry]

No description provided.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
- Quality Gate passed with no new issues, hotspots, or defects
Files changed: docs/compliance/1479-pr-quality-require-last-push-approval.md (no changes needed)
Skipped (informational): 0
Result: No actionable findings — PR is ready
```
The pull request has no actionable findings from the automated code analysis bot. All CI checks pass and there are no quality gate violations to address.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: fix-reviews)

PR: #1533
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-08-19T02:28:05Z

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: cc57d86d201c76a1537ee9478d2014cad9346765
Review mode: triage-approved (single reviewer)

Summary

Docs-only PR (+90, 1 new file) adding a compliance-verification document for issue #1479, recording that the reported ruleset drift (pr-quality / require_last_push_approval expected true, actual false) is stale: the live ruleset already carries the codified value. I independently re-verified the live ruleset (id 16142042) during this review and confirmed require_last_push_approval: true with enforcement: active — the document's central claim is accurate. This is a re-review after a prior fix-requested cycle at 66b6a73: the sole blocking finding there (an unresolved gemini-code-assist thread on capitalization/placeholder wording) has been addressed by commit cc57d86 and the thread is now resolved and outdated. No new issues introduced; the triage tier's low-risk assessment stands.

Linked issue analysis

Closes #1479 (ruleset-drift-pr-quality-require_last_push_approval, severity error). The issue's remediation path is an org-admin apply-rulesets.sh run from the public petry-projects/.github repo, not an in-repo file change — this repo intentionally carries only repo-specific rulesets to preserve the single source of truth. The document verifies the live state matches the standard and recommends closing #1479 as already remediated. Independent re-check during this review confirms the live value. Substantively addressed.

Findings

1. [Resolved] Prior review's only blocking finding — the unresolved gemini-code-assist thread (automation-integration capitalization; generic placeholder instead of the dev-lead persona) — was fixed in cc57d86; the thread is now resolved and marked outdated. No other threads exist.
2. [Verified] Live ruleset 16142042: require_last_push_approval: true, enforcement: active — matches the doc's claim and the codified standard.
3. [Verified] Internal relative links (.github/rulesets/release-channel-tags.json, docs/initiatives/auto-rebase-approval-survival-spike.md) exist on main.
4. [Info] run_secret_scanning MCP tool not available in this environment; gitleaks CI passed and the diff is pure markdown with no credential material.
5. No security, correctness, or maintainability issues in the changed document.

CI status

All checks green at cc57d86: Lint, ShellCheck, unit-tests, CodeQL (actions + python), Agent Security Scan, agent-shield, Secret scan (gitleaks), SonarCloud, CodeRabbit, Graphite AI Reviews, holdout-guard, duplicate-decl-gate, guard, Compile agentic workflows — all SUCCESS. One CANCELLED review / review run superseded by a later SUCCESS run; remaining SKIPPED entries are inapplicable ecosystem audits. mergeStateStatus BLOCKED solely on review requirements.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-08-19T03:00:49Z.